fix(http): allow projected MCP headers in preflights

[SamMorrowDrums]

Summary

• extend the browser CORS allowlist from fix(http): preserve CORS across OAuth routes #3147 with MCP 2026-07-28 Mcp-Method and Mcp-Name request headers plus the current Mcp-Param-owner and Mcp-Param-repo projections
• inspect every Access-Control-Request-Headers value on OPTIONS and reflect only valid, non-empty Mcp-Param-* field names
• deduplicate projected names case-insensitively, sort them deterministically, and emit canonical header casing without exposing request parameters as response headers
• preserve the existing wildcard-origin/no-credentials policy, fixed allowlist, exposed headers, downstream headers, and non-OPTIONS behavior

Exact projected-header contract

CORS has no prefix wildcard, so preflights validate each requested name with httpguts.ValidHeaderFieldName. Matching is case-insensitive against the exact Mcp-Param- prefix and requires a non-empty suffix. Fixed owner/repo entries remain first; future names are case-insensitively deduplicated, sorted, and emitted with http.CanonicalHeaderKey. Arbitrary headers, bare Mcp-Param-, malformed/control-character names, and lookalike prefixes are omitted.

Mcp-Param-* headers are request-only and are not added to Access-Control-Expose-Headers; Mcp-Session-Id and WWW-Authenticate remain exposed.

Cross-repository dependencies

• Follow-up to merged fix(http): preserve CORS across OAuth routes #3147 and the v1.11.0 direct/self-hosted HTTP contract.
• github/github-mcp-server-remote#955 must consume this commit or a release containing it for direct remote traffic; its stable dependency blocker remains until this change is merged and released.
• github/copilot-api#37229 separately owns matching hosted-edge preflight behavior.

Validation

• script/lint
• script/test

[Copilot]

Pull request overview

Extends browser CORS preflight support for MCP routing and projected parameter headers.

Changes:

• Adds fixed MCP method, name, owner, and repo headers.
• Validates, deduplicates, sorts, and reflects future Mcp-Param-* headers.
• Expands middleware and router-level CORS tests.

Show a summary per file

File	Description
pkg/http/server_test.go	Tests projected headers through the full router.
pkg/http/middleware/cors.go	Implements projected-header preflight handling.
pkg/http/middleware/cors_test.go	Covers validation, ordering, deduplication, and preserved behavior.
pkg/http/headers/headers.go	Defines MCP projection header constants.
go.mod	Promotes x/net to a direct dependency.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 8/9 changed files
• Comments generated: 0
• Review effort level: Balanced